Live › vulnerability › CVE-2026-120567
The MongoDB Entity Framework Core provider does not neutralize special syntax when it places a caller-supplied value into a bulk update expression. An attacker who controls that input can modify unintended fields in the records being updated and move existing data into other fields of the same record.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Applications that use the MongoDB Entity Framework Core provider and pass caller-supplied values into bulk update operations are exposed. Applications that do not use this provider, or that never feed request data into bulk updates, are unlikely to be affected. The sources do not give the affected version range.
No product ranges from the sources yet.
MongoDB.EntityFrameworkCore) in its .csproj or lock file.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-supplied value into a bulk update that is expressed as a databasea result, a value supplied as plain data may be interpreted by the database as expression syntax. A part value through normal application input may causeunintended modification of fields in the records the application is updating, and may cause data already held in those records to be relocated into other fields of the same record.
This page as .md · .json · in your agent: get_signal("CVE-2026-120567")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.